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DETAILED ACTION 

1 . Claims 39-56, 58 & 59 are pending. 

Information Disclosure Statement 

2. The information disclosure statement (IDS) submitted on 7-10-2009 is in 
compliance with the provisions of 37 CFR 1 .97. Accordingly, the information disclosure 
statement has been considered by the examiner. 

Response to Arguments 

3. Applicant's arguments filed 7-1 0-2009 have been fully considered but they are 
not persuasive. Regarding Applicant's argument that Kaltenmark does not teach how to 
analyze intercepted packets, or reconstruct user screens. Kaltenmark teaches how to 
analyze intercepted packets (See col. 15, lines 49-61; wherein data packets are 
intercepted by the middleware, firewalls or routers, and are analyzed in order to allow 
reconstruction of events). Further, even though "reconstructing user screens" is not in 
the claims, Kaltenmark does teach this limitation (See col. 15, lines 49-61 ; wherein 
monitoring actions of the user and reconstructing events, includes reconstructing user 
screens). 

Regarding Applicant's assertion that there is a typographical error on page 3, 
lines 12-13 of the first Office Action, because Examiner stated that the "management 
data" is the "mirror data". Examiner was equating the "management data" of 
Kaltenmark, to the "mirror data" in the claims. In other words, the "management data" 



Application/Control Number: 10/585,452 Page 3 

Art Unit: 2458 

of Kaltenmark includes data generated from user input and processes that is used later 
by a monitor to analyze events. Thus, the "management data" of Kaltenmark is 
equivalent to the claimed "mirror data". 

Regarding Applicant's argument that Kaltenmark does not teach how to maintain 
the mirror data. "Maintaining the mirror data" is not a limitation in the claims. If 
Applicant is referring to "storing the mirror data", then Kaltenmark teaches such storing 
(See col. 21 , lines 28-29; wherein the management data of Kaltenmark, is Applicant's 
mirror data). 

Regarding Applicant's argument that Beckett does not teach handling and 
maintaining mirror data and/or mirror sessions. "Handling and maintaining mirror data 
and/or mirror sessions" is not a limitation in the claims. If Applicant is referring to 
"storing the mirror data and/or mirror sessions", then Kaltenmark was the reference that 
was applied to teach such storing (See col. 21 , lines 28-29; wherein the management 
data of Kaltenmark, is Applicant's mirror data). 



Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

4. Claim 39 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 
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5. Regarding claim 39, "an incremental screen protocol" in line 6, causes the claim 
to be vague and indefinite. "An incremental screen protocol" is introduced in line 2 of 
the claim. It is not clear if the "screen protocol" of line 6, is the same protocol 
introduced in line 2, or if Applicant is introducing a second protocol. 



Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

6. Claims 39-47 & 58 are rejected under 35 U.S.C. 1 01 because the claimed 
invention is directed to non-statutory subject matter. 

7. Regarding claims 39-47, it is possible for all of the limitations in the body of the 
claims to be completed by software. Thus, a broadest possible interpretation of the 
claims includes software, per se, which is not patentable subject matter. Applicant can 
overcome this rejection by including some computer hardware in the body of the claims. 

8. Regarding claim 58, this claim is directed toward a computer useable medium. 
Applicant has not limited this "medium", in the claims nor in the specification, to a 
physical medium. Thus, a broadest possible interpretation of the claimed "medium" has 
to include carrier waves and transitory signals, which are not statutory subject matter. 
Applicant can overcome this rejection by including some tangible computer useable 
medium in the claim, or in the specification. 
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Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

1 . Claims 39-44, 46-53, 55, 56, 58 & 59 are rejected under 35 U.S.C. 1 02(e) as 
being anticipated by U.S. Patent No. 7,415,509 issued to Kaltenmark, et al. 
(Kaltenmark). 

2. Regarding claim 39, Kaltenmark teaches an apparatus configured to monitor and 
audit activity in a network, the network utilizes an incremental protocol, the apparatus 
comprising: an analyzer being configured to analyze intercepted packets, wherein the 
packets are conveyed by entities in the network, and being configured to generate 
analyzed data based on information associated with at least some of said packets (See 
column 14, lines 19-24; wherein monitoring is accomplished by intercepting packets), 
the analyzed data being indicative of sessions (See column 5, lines 29-35) and being 
indicative of an incremental screen protocol used in each of said sessions (See col. 13, 
lines 44-47; wherein the screen updates of the remote management tool, is the 
incremental screen protocol); a mirror manager responsive to said analyzed data for 
generating mirror data representative of mirror sessions, each mirror session 
corresponding to one of said sessions (See col. 20, lines 62-65; wherein management 
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data is the mirror data); and an audit event analyzer being responsive to said mirror 
data, said audit event analyzer being configured to generate event data representative 
of inbound audit events and outbound audit events, said event data including 
characteristics relating to at least on-screen field location of data being part of the 
inbound audit events and outbound audit events, said at least on-screen field location 
being representative of at least one operation performed in the network (See col. 13, 
lines 47-51 ; wherein the diagnostics done by the remote support person, is the at least 
one operation performed in the network) said audit event analyzer being adapted to 
analyze said event data for extracting extracted data from event data representative of 
an inbound audit event together with the characteristics respective of said inbound audit 
event, and to generate event data representative of a united audit event by combining 
the extracted data with one or more fields in event data representative of an outbound 
audit event based on said characteristics (See col. 20, line 65 to col. 21 , line 6; wherein 
the event filtering generates extracted data, and event correlation produces united audit 
events). 

3. Regarding claim 40, Kaltenmark teaches a business event analyzer for 
processing at least part of said event data representative of outbound, inbound and 
united audit events and generating data representative of business events (See col. 21, 
lines 6-9; wherein the management event is a business event; and See col. 12, lines 51- 
61). 
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4. Regarding claim 41 , Kaltenmark teaches an alerts manager coupled to the 
business event analyzer and being responsive to said data representative of business 
events for generating alerts (See col. 21 , lines 9-15). 

5. Regarding claim 42, Kaltenmark teaches the alerts manager is configured 

to generate at least some of the alerts based on predetermined thresholds (See col. 21 , 
lines 6-9). 

6. Regarding claim 43, Kaltenmark teaches a first long term storage device for 
storing at least part of said analyzed data (See col. 20, lines 37-40; wherein the 
repositories includes a first storage device). 

7. Regarding claim 44, Kaltenmark teaches a second long term storage device for 
storing at least part of said mirror data representative of mirror sessions (See col. 21 , 
lines 21-24; wherein the repositories includes a second storage device). 

8. Regarding claim 46, Kaltenmark teaches an encryption agent for encrypting at 
least part of the mirror data representative of mirror sessions (See col. 16, lines 5-6 & 
63-64). 

9. Regarding claim 47, Kaltenmark teaches a signature agent for digitally signing at 
least part of the mirror data representative of mirror sessions (See col. 17, lines 4-7). 

10. Regarding claim 48, Kaltenmark teaches a method of monitoring and auditing 
activity in a network, the network utilizes an incremental protocol, the method 
comprising: analyzing intercepted packets conveyed by entities in the network (See col. 
14, lines 19-24; wherein monitoring is accomplished intercepting packets); generating 
analyzed data based on information associated with at least some of said packets (See 
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col. 20, lines 37-40), the analyzed data being indicative of sessions (See col. 5, lines 
29-35) and being indicative of an incremental screen protocol used in each of the said 
sessions (See col. 13, lines 44-47; wherein the diagnostic update screens, is the 
incremental screen protocol); responsive to said analyzed data generating in respect of 
one or more of said sessions mirror data representative of one or more mirror sessions, 
each mirror session corresponding to a session (See col. 20, lines 62-65; wherein 
management data is the mirror data); and, generating event data representative of 
inbound audit events and outbound audit events, said event data including 
characteristics relating to at least on-screen field location of data being part of the 
inbound audit events and outbound audit events (See col. 20, lines 65-67), said at least 
on-screen field location being representative of at least one operation performed in the 
network (See col. 13, lines 47-51 ; wherein the diagnostics performed by the support 
person, is the at least one operation); extracting extracted data from event data 
representative of an inbound audit event together with the characteristics respective of 
said inbound audit event (See col. 21 , lines 1-4; wherein event filtering generates 
extracted data); and generating event data representative of a united audit event by 
combining the extracted data with one or more fields in event data representative of an 
outbound audit event based on said characteristics (See col. 21, lines 3-6; wherein 
event correlation generates united audit events). 

1 1 . Regarding claim 49, this claim recites a method for operating the apparatus of 
claim 40, and is rejected for the same reasons. 
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12. Regarding claim 50, this claim recites a method for operating the apparatus of 
claim 41 , and is rejected for the same reasons. 

1 3. Regarding claim 51 , this claim recites a method for operating the apparatus of 
claim 42, and is rejected for the same reasons. 

14. Regarding claim 52, this claim recites a method for operating the apparatus of 
claim 43, and is rejected for the same reasons. 

15. Regarding claim 53, this claim recites a method for operating the apparatus of 
claim 44, and is rejected for the same reasons. 

16. Regarding claim 55, this claim recites a method for operating the apparatus of 
claim 46, and is rejected for the same reasons. 

17. Regarding claim 56, this claim recites a method for operating the apparatus of 
claim 47, and is rejected for the same reasons. 

18. Regarding claim 58, this claim recites a program product for carrying out the 
method of claim 48, and is rejected for the same reasons. 

19. Regarding claim 59, Kaltenmark teaches a terminal responsive to said event data 
representative of a united audit event for displaying said united audit event without 
requiring that preceding outbound and inbound audit events be displayed prior thereto 
(See col. 21, lines 11-16). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 
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(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

20. Claims 45 & 54 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kaltenmark, as applied to claims 39 & 48, in view of U.S. Patent No. 5,790,798 issued 
to Beckett, II, etal. (Beckett). 

21 . Regarding claim 45, Kaltenmark teaches the invention as described in claim 39. 
Kaltenmark does not teach a compression agent for compressing at least part of the 
mirror data representative of mirror sessions. However, Beckett teaches this limitation 
(See column 14, lines 15-19). Using the feature of Beckett in the system of Kaltenmark 
would have reduced required bandwidth during transmission and reduced the amount of 
required memory space during storage. Therefore, it would have been obvious to one 
of ordinary skill, at the time of the invention, to combine the teachings of Beckett and 
Kaltenmark. 

22. Regarding claim 54, this claim recites a method for operating the apparatus of 
claim 45, and is rejected for the same reasons. 



Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jeffrey Seto whose telephone number is (571)270-7198. 
The examiner can normally be reached on Monday thru Thursday and alt. Fridays, 9:30 
AM-7 PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Joseph E. Avellino can be reached on (571 ) 272-3905. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



JKS 

10/6/2009 
/NATHAN FLYNN/ 

Supervisory Patent Examiner, Art Unit 2454 



